Skip to content
OpenAdvisories

Vendor

Pilz

7 known vulnerabilities.

Pilz at a glance

Last 12 months
2
Critical · all time
2
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202620
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202522
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

PASvisu 3 PMI v8xx 2 Pilz PNOZmulti Configurator 1 PMI v5xx (265507 + 265512) 1 PMI v7xx (266704 + 266707) 1 PMI v8xx (266807, 266812, 266815) 1 PAScal 1 PASconnect 1 PASmotion 1 PNOZmulti Configurator 1 PNOZmulti Configurator LTS 1 PAS4000 1 IndustrialPI 4 with IndustrialPI webstatus 1 IndustrialPI 4 with Firmware Bullseye 1 PIT Transponder Manager 0 PNOZsigma Configurator 0 Software Live Video Server 0 Software PAS4000 0 Software PASvisu 0 Software PIT User Authentication Service 0 Software SafetyEYE Configurator 0 PASvisu Software 0 PMI v5xx 0 PMI v7xx 0 CODESYS DevSys 0 Live Video Server 0 PASloto 0 PNOZsigma 0 SafetyEYE 0 PIT User Authentication Service 0 PMIv7xxe 0 PMIv8xx 0 Firmware 0 Firmware PMI v70Xe 0 Firmware PMI v8 0 IndustrialPI 4 0 Bullseye 0 PiCtory 0 IndustrialPI webstatus 0 PIT gb RLLE y down ETH 0

Latest advisories

  • High max 6.9
    PPSA-2026-005 3 CVEs

    Pilz: Vulnerabilities in 'PiCtory' and 'RevPiPyLoad' for Industrial PC IndustrialPI

    The 'Pictory' web config tool, prior to 2.17.0, has a Cross-Site Request Forgery (CSRF) vulnerability, which makes it vulnerable to session takeover. The 'revpipyload' package, prior to version 0.11.1, has a vulnerability in the file management functionality …

    KUNBUS Pilz
  • High max 7.3
    PPSA-2026-004 3 CVEs

    Pilz: Vulnerabilities in 'piControl' kernel module for Industrial PC IndustrialPI

    The 'piControl' kernel module used in the IndustrialPI, prior to version 2.8.0-1, contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can lead to kernel memory corruption and denial of service.

    KUNBUS Pilz
  • High max 8.8
    PPSA-2026-003 3 CVEs 2 exploited

    Pilz: Multiple Vulnerabilities affecting industrial PC IndustrialPI

    The Linux kernel used in the IndustrialPI, 'linux-image-revpi-v8', prior to version 6.12.91-revpi0-rpi-v8 contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can give an attacker full control over the device.

    KUNBUS Pilz
  • High max 7.5
    PPSA-2026-002 1 CVE

    Pilz: Vulnerability affecting PASvisu Runtime

    The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by malicious web requests.

    Pilz
  • High max 9.4
    PPSA-2026-001 4 CVEs rev. 2

    Pilz: Multiple Vulnerabilities affecting the PIT User Authentication Service

    **PIT User Authentication Service is part of the operating mode selection and access permission system PITmode.** The PIT User Authentication Service is affected by multiple vulnerabilities in included third-party components.

    Pilz
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.8
    CVE-2023-45795

    Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx

    A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.

    Pilz PASvisu PMI v8xx
  • High 8.1
    CVE-2023-45796

    XSS vulnerability in Pilz PASvisu and PMI v8xx

    A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity…

    Pilz PASvisu PMI v8xx
  • Critical 9.8
    CVE-2025-41648

    Pilz: Authentication Bypass in IndustrialPI Webstatus

    An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

    Pilz IndustrialPI 4 with IndustrialPI webstatus
  • Critical 10.0
    CVE-2025-41656 Public exploit EPSS 12%

    Pilz: Missing Authentication in Node-RED integration

    An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

    Pilz IndustrialPI 4 with Firmware Bullseye
  • High 7.5
    CVE-2022-40977

    PILZ: PASvisu and PMI affected by ZipSlip

    A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or…

    Pilz PASvisu PMI v7xx (266704 + 266707) PMI v5xx (265507 + 265512)
  • Medium 5.5
    CVE-2022-40976

    PILZ: Multiple products affected by ZipSlip

    A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availabilit…

    Pilz PNOZmulti Configurator LTS PASconnect PNOZmulti Configurator
  • Unscored —
    CVE-2018-19009

    Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system cont…

    Pilz Pilz PNOZmulti Configurator